search

gohugoio / hugo

The world’s fastest framework for building websites.
https://gohugo.io
Apache License 2.0
75.38k stars 7.49k forks source link

Make the release script more robust #9785

Closed bwagner5 closed 10 months ago

bwagner5 commented 2 years ago

What version of Hugo are you using (hugo version)?

v0.97.0

Does this issue reproduce with the latest release?

Yes

When installing v0.97.0 w/ go install w/o the google go proxy, a checksum mismatch occurs. 

$ go clean -modcache
$ GOPROXY=direct go install github.com/gohugoio/hugo@v0.97.0+extended
go: downloading github.com/gohugoio/hugo v0.97.0
go: github.com/gohugoio/hugo@v0.97.0+extended: github.com/gohugoio/hugo@v0.97.0: verifying module: checksum mismatch
    downloaded: h1:VkjBIIADmPnxhA9t4XhNuH2H/U8fg5u5G3dsvS3jBBk=
    sum.golang.org: h1:cKR421+00hzlh8H5ckmtkWAZbKjIT7hDPY7h/DXEQiI=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.
bep commented 2 years ago

This will fix itself with the next Hugo release. If you want it fixed sooner, you may want to talk to the maintainers of the gosum db that has the wrong version registered (admittengly due to me having to start over the release twice because of tech failures).

bep commented 2 years ago

Since we don't have any "edit release notes step" in the release notes script anymore, we could probably delay the creating of the release on GitHub (with the tag) until after we have built all the binaries (which is where it failed in this scenario).

silverwind commented 1 year ago

FWIW, 0.81.0 also appears to be a similarily broken release:

go clean -modcache && GOPROXY=direct go run github.com/gohugoio/hugo@v0.81.0 --help
go: downloading github.com/gohugoio/hugo v0.81.0
go: github.com/gohugoio/hugo@v0.81.0: github.com/gohugoio/hugo@v0.81.0: verifying module: checksum mismatch

    downloaded: h1:zToI15wYh6oh4SRAaoy39XixwmiPB0DZDjsgu9szknY=
    sum.golang.org: h1:PX8TYe1nrWOOMBWtQ/YvKs6QRrOjC5/RrZGE4tBb6EE=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.
jmooring commented 10 months ago

This seems to have been fixed, to the extent possible, with the move to https://github.com/gohugoio/hugoreleaser/.

github-actions[bot] commented 10 months ago

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.